Access violation when adding Custom Property

[AtD]

Hi all,
I created a macro that does some cool stuff, but unfortunately it kills FreeCAD without any helpful output or logs to work with.
So I went and looked manually for the critical operation. The following is an abstract process of what my script does, just to reproduce the issue. Basically what I want to do is to have a TechDraw-Drawing showing some geometry. But additionally to normal dimensions I want to use the "expertimental" dimension called Landmark dimension. Imagine adding a dimension to some external point you dont have in your model, but know the coordinates. Following steps to reproduce:
1) create 2 or more Draft.PointObjects at different coordinates
2) create a dummy body to show in TechDraw
3) create a sheet, add a view of the body
4) select the view and the 2 points in the model tree and hit the landmark dimensioning tool (dimension is introduced).
Up until here, everything is fine. However, I want these points to have some custom property. So, in the Python Console I do:
5)

Code: Select all

App.ActiveDocument.Point.addProperty("App::PropertyString", "Position")
App.ActiveDocument.Point.Position = "MyFancyLocation"

Works until here, however now, if I go to the Point object and
6) change one of the coordinates, something breaks. I get an

Code: Select all

<Exception> Access violation

shown at the landmarkDim-Object in the model tree.
I am not completely sure, whether this also causes FreeCAD to shut down after my full macro, but at least it is something going wrong. Also the file seems to be broken after that, I cannot delete the landmarkDim object.
Looks like a bug to me. Any suggestions, remarks?

I attach the working example up until step 5. You can reproduce from there.


OS: Windows 10 (10.0)
Word size of OS: 64-bit
Word size of FreeCAD: 64-bit
Version: 0.19.24212 (Git)
Build type: Release
Branch: master
Hash: 3d227cf7179c00e57f2733f947b4b1b0368d219a
Python version: 3.8.8
Qt version: 5.12.5
Coin version: 4.0.0
OCC version: 7.4.0
Locale: German/Germany (de_DE)

[TheMarkster]

I am unable to reproduce any issues.

OS: Windows 10 (10.0)
Word size of OS: 64-bit
Word size of FreeCAD: 64-bit
Version: 0.19.24267 (Git)
Build type: Release
Branch: master
Hash: b2ca86d8d72b636011a73394bf9bcdedb3b109b7
Python version: 3.8.8
Qt version: 5.12.5
Coin version: 4.0.0
OCC version: 7.4.0
Locale: English/United States (en_US)

Snip macro screenshot-9b5499.png (30.05 KiB) Viewed 2852 times

Snip macro screenshot-991217.png (52.7 KiB) Viewed 2852 times

[AtD]

Interesting! I will try with your version. Thanks for testing!

[AtD]

Ok, I could now reproduce the actual crash of FreeCAD that I experience after executing my script. It involves one more step:
7) Open the sketch of Pad and close it again (no change needed).
FreeCAD just closes. Can you reproduce that? I got the latest version 0.1924291. I doubt it was fixed in your version and doesnt work again in the latest one.

[chrisb]

I can reproduce the issue here. After execution of the console command, the Point is left in a state to be recomputed. A recompute doesn't crash FreeCAD, but editing and closing the sketch does.

OS: macOS 10.16
Word size of FreeCAD: 64-bit
Version: 0.20.25566 (Git)
Build type: Release
Branch: master
Hash: 8c361dd3fc83840a911da950a845eb9f9342a0b6
Python version: 3.9.6
Qt version: 5.12.9
Coin version: 4.0.0
OCC version: 7.5.2
Locale: C/Default (C)

[chrisb]

It doesn't need at all the addition of the custom property. The file is already broken without it. To reproduce:

- open the file attached above
- open Sketch
- close Sketcher
-> crash.

[openBrain]

Here is the top of the stacktrace. TechDraw is indeed the culprit.

Code: Select all

#7  0x00007f599e7fa104 in TechDraw::GeometryObject::clear() (this=0x561dbd105280) at /home/OB/dev/FreeCAD/src/Mod/TechDraw/App/GeometryObject.cpp:164
        it = 0x561dbd355ee0
#8  0x00007f599e7f9cd0 in TechDraw::GeometryObject::~GeometryObject() (this=0x561dbd105280, __in_chrg=<optimized out>) at /home/OB/dev/FreeCAD/src/Mod/TechDraw/App/GeometryObject.cpp:105
#9  0x00007f599e7f9de0 in TechDraw::GeometryObject::~GeometryObject() (this=0x561dbd105280, __in_chrg=<optimized out>) at /home/OB/dev/FreeCAD/src/Mod/TechDraw/App/GeometryObject.cpp:106
#10 0x00007f599e767c1b in TechDraw::DrawViewPart::partExec(TopoDS_Shape) (this=0x561dbd5a7a90, shape=...) at /home/OB/dev/FreeCAD/src/Mod/TechDraw/App/DrawViewPart.cpp:357
#11 0x00007f599e767702 in TechDraw::DrawViewPart::execute() (this=0x561dbd5a7a90) at /home/OB/dev/FreeCAD/src/Mod/TechDraw/App/DrawViewPart.cpp:292
        doc = 0x561dbd0da120
        isRestoring = false
        links = std::vector of length 1, capacity 1 = {0x561dbd3d3320}
        shape = {myTShape = {entity = 0x561dbdc613b0}, myLocation = {myItems = {myNode = {entity = 0x0}}}, myOrient = TopAbs_FORWARD}
        haveX = true
#12 0x00007f5a3c613333 in App::DocumentObject::recompute() (this=0x561dbd5a7a90) at /home/OB/dev/FreeCAD/src/App/DocumentObject.cpp:115
        exe = {status = App::Recompute, obj = 0x561dbd5a7a90, old_value = false}
        ret = 0x7f5a3b9f3fe8 <std::set<Base::ILogger*, std::less<Base::ILogger*>, std::allocator<Base::ILogger*> >::end() const+28>
#13 0x00007f599e75b90d in TechDraw::DrawView::recompute() (this=0x561dbd5a7a90) at /home/OB/dev/FreeCAD/src/Mod/TechDraw/App/DrawView.cpp:99
#14 0x00007f5a3c51636f in App::Document::_recomputeFeature(App::DocumentObject*) (this=0x561dbd0da120, Feat=0x561dbd5a7a90) at /home/OB/dev/FreeCAD/src/App/Document.cpp:3747
        returnCode = 0x0
#15 0x00007f5a3c5141da in App::Document::recompute(std::vector<App::DocumentObject*, std::allocator<App::DocumentObject*> > const&, bool, bool*, int) (this=0x561dbd0da120, objs=std::vector of length 0, capacity 0, force=false, hasError=0x0, options=0) at /home/OB/dev/FreeCAD/src/App/Document.cpp:3496
        res = 0
        obj = 0x561dbd5a7a90
        doRecompute = true
        seq = std::unique_ptr<Base::SequencerLauncher> = {get() = 0x0}
        passes = 0
        objectCount = 4
        t = {__d = {__r = 1630652277995167521}}
        exe = {status = App::Document::Recomputing, obj = 0x561dbd0da120, old_value = false}
        topoSortedObjects = std::vector of length 16, capacity 16 = {0x561dbd4916a0, 0x561dbd4ae0d0, 0x561dbd4de640, 0x561dbd432bf0, 0x561dbd451900, 0x561dbd4461e0, 0x561dbd469350, 0x561dbd499940, 0x561dbd42bd30, 0x561dbd3d3320, 0x561dbd514ab0, 0x561dbd501fd0, 0x561dbd57a1b0, 0x561dbd5a7a90, 0x561dbd5924f0, 0x561dbd564a40}
        hGrp = {_toHandle = 0x561dbabd9230}
        canAbort = false
        filter = std::set with 0 elements
        idx = 13
        t2 = {__d = {__r = 1630652277996096362}}
#16 0x00007f5a3c6a23a2 in App::DocumentPy::recompute(_object*) (this=0x561dbd17bdd0, args=0x7f5a340ee040) at /home/OB/dev/FreeCAD/src/App/DocumentPyImp.cpp:488
        objs = std::vector of length 0, capacity 0
        options = 0
        objectCount = 954631467
        pyobjs = 0x7f5a3b7c0360 <_Py_NoneStruct>
        force = 0x7f5a3b7c0340 <_Py_FalseStruct>
        checkCycle = 0x7f5a3b7c0340 <_Py_FalseStruct>
#17 0x00007f5a3c699b68 in App::DocumentPy::staticCallback_recompute(_object*, _object*) (self=0x561dbd17bdd8, args=0x7f5a340ee040) at /home/OB/dev/FCBuild/src/App/DocumentPy.cpp:1580
        ret = 0x7fff3ef42b60

[AtD]

Ah glad you can reproduce.
Basically for that application it seems the landmark dim cannot be used without risking a crash.

Should I open a bug report for that? I've never done that, so I need to look into how to submit one ...

[openBrain]

Here is the cause (it's gonna be a bit technical).
At time where TechDraw clears an object (I don't know the circumstances of that, I have no particular knowledge of TechDraw), in 'VertexGeom' variable there are duplicated pointers :

crash.png (88.76 KiB) Viewed 2931 times

As it deletes the pointed objects one after the other, when it reaches the 2nd instance of a pointer, the pointed object already has been deleted and thus it crashes with a segfault when trying to access it.

I could add a defensive patch but probably it would be better to understand how such duplicate comes and fix this.

[chrisb]

Edi, can you help?